Free Password Generator
Generate strong random passwords entirely in your browser.
Pick a length and character sets, and get cryptographically secure random passwords with a live strength estimate. Switch to passphrase mode when you need something long that you can actually remember.
crypto.getRandomValues). Your options and results never leave your device —
they are never sent to our servers, and nothing is stored anywhere.
Click the password (or the Copy button) to copy it.
Options
Recent passwords
Kept only in this tab’s memory — cleared the moment you close or reload the page. Nothing is saved.
How this password generator works
Every random value on this page comes from crypto.getRandomValues(), the
Web Crypto API, which your browser fills from the operating system’s cryptographic
random number generator. That is the same class of randomness used for TLS session keys
and password-hashing salts — not the predictable Math.random() that
many casual generators rely on.
Drawing a character from a pool of N characters is done with rejection sampling: the generator takes a random 32-bit integer and redraws it whenever the value would make the distribution uneven. The result is that every character in your selected pool is exactly equally likely. When “guarantee at least one from each set” is on, one character is drawn from each selected set first, the rest are filled from the full pool, and the whole result is shuffled with the same secure randomness — so the guaranteed characters are not always at the front.
Passphrase mode draws each word from an embedded list of 512 common words, which gives 9 bits of entropy per word. The list ships with the page and is used entirely in your browser.
Nothing leaves your device. There is no server round-trip when you generate, no analytics on your inputs, and no storage of any kind.
Why length beats complexity
A password’s strength is measured in bits of entropy — how large the search space is for an attacker. Each extra character multiplies that space, which is why a long simple password routinely beats a short complex one:
| Password | Entropy |
|---|---|
| 8 characters, all four sets (88-character pool) | ≈ 52 bits |
| 12 characters, all four sets | ≈ 78 bits |
| 16 characters, all four sets | ≈ 103 bits |
| 20 lowercase letters (26-character pool) | ≈ 94 bits |
| 5-word passphrase + digit | ≈ 48 bits |
| 8-word passphrase + digit | ≈ 75 bits |
At 10 billion guesses per second — a fast GPU rig — a 78-bit password takes roughly half a million years on average to crack, while a 48-bit passphrase takes fractions of a second. If you use a password manager, go long and random (20+ characters); if you have to remember it, an 8-word passphrase is a sensible trade-off.
Tips for using generated passwords
- Use a different password for every account — reuse is how one breach becomes many.
- Store generated passwords in a password manager (Bitwarden, KeePassXC, or your browser’s built-in manager). With a manager, length is free.
- Turn on two-factor authentication wherever it is offered — it protects you even if a password leaks.
- Never reuse your email account’s password anywhere else — it is the key to every password-reset link you own.
- If you must remember a password, use passphrase mode and keep a written backup somewhere safe.
